CVE-2026-89881 - Vulnerability Details

- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

Description

In the Linux kernel, the following vulnerability has been resolved:

media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

rtl2832_sdr_remove() runs on USB disconnect and clears dev->udev to
NULL before any pending streaming teardown has run. When user space
later closes its file descriptor, vb2 calls rtl2832_sdr_stop_streaming()
which in turn calls rtl2832_sdr_free_stream_bufs(). That helper releases
each coherent buffer with:

usb_free_coherent(dev->udev, dev->buf_size,
dev->buf_list[dev->buf_num],
dev->dma_addr[dev->buf_num]);

usb_free_coherent() returns immediately when its dev argument is NULL,
so every DMA stream buffer that was live at disconnect is silently
leaked. The URBs allocated in rtl2832_sdr_alloc_urbs() outlive the
device for the same reason.

The rtl2832_sdr driver uses vb2_fop_release() in its file_operations,
so replace video_unregister_device(&dev->vdev) with
vb2_video_unregister_device(&dev->vdev) and move it before clearing
dev->udev. vb2_video_unregister_device() releases the vb2 queue, which
synchronously runs rtl2832_sdr_stop_streaming() if streaming is active,
so URBs and coherent DMA stream buffers are freed while dev->udev is
still valid.

vb2_video_unregister_device() locks vdev->queue->lock (vb_queue_lock)
internally, and stop_streaming() locks v4l2_lock, so the previous outer
mutex_lock(&dev->vb_queue_lock) / mutex_lock(&dev->v4l2_lock) pair
around the unregister sequence would self-deadlock and has been removed.
A short v4l2_lock critical section around dev->udev = NULL remains so
any ioctl path that still holds the file descriptor sees coherent state.

Issue identified by automated review of the INV-003 series at
https://sashiko.dev/

Published: 2026-09-16

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The rtl2832_sdr kernel driver for Linux audio devices contains a resource leak: on USB disconnect, the driver clears the device reference before releasing DMA buffers and URBs, causing usb_free_coherent to silently drop the buffers when a NULL argument is passed. The leaked coherent DMA buffers and URBs accumulate, leading to incremental memory consumption and potential exhaustion, but do not provide an attacker with direct control or privilege escalation.

Affected Systems

Any Linux kernel that includes the rtl2832_sdr media driver before the applied patch is affected. The specific kernel versions are not enumerated in the available data, but the vulnerability was fixed in a recent kernel revision after commit 034b6a4f9.

Risk and Exploitability

The EPSS score is below 1 %, indicating a very low probability of exploitation in production environments, and the vulnerability is not listed in CISA’s KEV catalog. While the CVSS score is not provided, the impact is limited to resource exhaustion. An attacker would need local access to control USB disconnects and active streaming, making realistic exploitation unlikely. The overall risk is thus low but non‑negligible for systems that frequently plug and unplug SDR devices.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`771138920eafa399f68d3492c8a75dfeea23474b`	affected	< 234c46b95a032232e31fa5987b84fb8f87a9693b
`771138920eafa399f68d3492c8a75dfeea23474b`	affected	< 034b6a4f9589c04bc3f2bd5125658cd72d3e17c8
`771138920eafa399f68d3492c8a75dfeea23474b`	affected	< 0ef9f19010ae4ba93aca211ea8f0081b9bf7aab2
`771138920eafa399f68d3492c8a75dfeea23474b`	affected	< 053581d4657c6b5289c5de71a4828d313c005189
`771138920eafa399f68d3492c8a75dfeea23474b`	affected	< bbf15e83c37d9ac938b7c35c02b748fe54230010
`771138920eafa399f68d3492c8a75dfeea23474b`	affected	< 7443b16b6dd8889a3b9c5236a09e7c58f0d11dae
`771138920eafa399f68d3492c8a75dfeea23474b`	affected	< a0d9d9a3b41a1346c26af57aade6ba3f552fa171
`771138920eafa399f68d3492c8a75dfeea23474b`	affected	< dabb047c62668f280998e29117c55e41aabac336

Linux

affected

Version	Status	Constraints
`3.15`	affected	—
`0`	unaffected	< 3.15
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Kernel

99%

Version	Status	Scheme	Platform
`[771138920eafa399f68d3492c8a75dfeea23474b,234c46b95a032232e31fa5987b84fb8f87a9693b)`	affected	code_commit	—
`[771138920eafa399f68d3492c8a75dfeea23474b,034b6a4f9589c04bc3f2bd5125658cd72d3e17c8)`	affected	code_commit	—
`[771138920eafa399f68d3492c8a75dfeea23474b,0ef9f19010ae4ba93aca211ea8f0081b9bf7aab2)`	affected	code_commit	—
`[771138920eafa399f68d3492c8a75dfeea23474b,053581d4657c6b5289c5de71a4828d313c005189)`	affected	code_commit	—
`[771138920eafa399f68d3492c8a75dfeea23474b,bbf15e83c37d9ac938b7c35c02b748fe54230010)`	affected	code_commit	—
`[771138920eafa399f68d3492c8a75dfeea23474b,7443b16b6dd8889a3b9c5236a09e7c58f0d11dae)`	affected	code_commit	—
`[771138920eafa399f68d3492c8a75dfeea23474b,a0d9d9a3b41a1346c26af57aade6ba3f552fa171)`	affected	code_commit	—
`[771138920eafa399f68d3492c8a75dfeea23474b,dabb047c62668f280998e29117c55e41aabac336)`	affected	code_commit	—

Linux

Kernel

99%

Version	Status	Scheme	Platform
`3.15`	affected	semver	—
`[0,3.15)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version that contains the rtl2832_sdr.remove() fix (e.g., commit 034b6a4f9).
If an immediate kernel upgrade is unavailable, unload or blacklist the rtl2832_sdr driver during maintenance, e.g., by adding "blacklist rtl2832_sdr" to modprobe.conf or using "modprobe -r rtl2832_sdr" before unplugging the device.
Monitor system memory after USB disconnect events to detect leaking DMA buffers and intervene if memory consumption rises unexpectedly.

Generated by OpenCVE AI on September 18, 2026 at 08:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/034b6a4f9589c04bc3f2bd5125658cd72d3e17c8
https://git.kernel.org/stable/c/053581d4657c6b5289c5de71a4828d313c005189
https://git.kernel.org/stable/c/0ef9f19010ae4ba93aca211ea8f0081b9bf7aab2
https://git.kernel.org/stable/c/234c46b95a032232e31fa5987b84fb8f87a9693b
https://git.kernel.org/stable/c/7443b16b6dd8889a3b9c5236a09e7c58f0d11dae
https://git.kernel.org/stable/c/a0d9d9a3b41a1346c26af57aade6ba3f552fa171
https://git.kernel.org/stable/c/bbf15e83c37d9ac938b7c35c02b748fe54230010
https://git.kernel.org/stable/c/dabb047c62668f280998e29117c55e41aabac336

History

Sat, 19 Sep 2026 11:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux kernel
Vendors & Products		Linux kernel

Fri, 18 Sep 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-789

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak rtl2832_sdr_remove() runs on USB disconnect and clears dev->udev to NULL before any pending streaming teardown has run. When user space later closes its file descriptor, vb2 calls rtl2832_sdr_stop_streaming() which in turn calls rtl2832_sdr_free_stream_bufs(). That helper releases each coherent buffer with: usb_free_coherent(dev->udev, dev->buf_size, dev->buf_list[dev->buf_num], dev->dma_addr[dev->buf_num]); usb_free_coherent() returns immediately when its dev argument is NULL, so every DMA stream buffer that was live at disconnect is silently leaked. The URBs allocated in rtl2832_sdr_alloc_urbs() outlive the device for the same reason. The rtl2832_sdr driver uses vb2_fop_release() in its file_operations, so replace video_unregister_device(&dev->vdev) with vb2_video_unregister_device(&dev->vdev) and move it before clearing dev->udev. vb2_video_unregister_device() releases the vb2 queue, which synchronously runs rtl2832_sdr_stop_streaming() if streaming is active, so URBs and coherent DMA stream buffers are freed while dev->udev is still valid. vb2_video_unregister_device() locks vdev->queue->lock (vb_queue_lock) internally, and stop_streaming() locks v4l2_lock, so the previous outer mutex_lock(&dev->vb_queue_lock) / mutex_lock(&dev->v4l2_lock) pair around the unregister sequence would self-deadlock and has been removed. A short v4l2_lock critical section around dev->udev = NULL remains so any ioctl path that still holds the file descriptor sees coherent state. Issue identified by automated review of the INV-003 series at https://sashiko.dev/
Title		media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/034b6a4f9589c04bc3f2bd5125658cd72d3e17c8 https://git.kernel.org/stable/c/053581d4657c6b5289c5de71a4828d313c005189 https://git.kernel.org/stable/c/0ef9f19010ae4ba93aca211ea8f0081b9bf7aab2 https://git.kernel.org/stable/c/234c46b95a032232e31fa5987b84fb8f87a9693b https://git.kernel.org/stable/c/7443b16b6dd8889a3b9c5236a09e7c58f0d11dae https://git.kernel.org/stable/c/a0d9d9a3b41a1346c26af57aade6ba3f552fa171 https://git.kernel.org/stable/c/bbf15e83c37d9ac938b7c35c02b748fe54230010 https://git.kernel.org/stable/c/dabb047c62668f280998e29117c55e41aabac336

Subscriptions

Linux Kernel Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:31:46.966Z

Updated: 2026-09-16T10:31:46.966Z

Reserved: 2026-09-11T19:38:34.772Z

Link: CVE-2026-89881

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:16:56.503

Modified: 2026-09-16T11:16:56.503

Link: CVE-2026-89881

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-19T11:30:06Z

Weaknesses

CWE-789
Memory Allocation with Excessive Size Value

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object